I am at the end of day two of teaching an introductory ACL to a really good group of students. They are quick to grasp the concepts as we go through different commands and ACL functionality. They are able to answer pointed questions like: give me three ways to ‘sort’ a file. However, when I ask, “where could you use ‘insert an ACL command here’ in your audit work?” they have a hard time responding.
I told them my experience with a router (for woodworking). My brother sold most of his possessions and bought a sailboat. He was an excellent carpenter and did not want to sell his router – so he gave it to me. Several months later (during hurricane season) he was back home and asked me what I had made with the route. “Nothing”, I replied. When he asked why, I replied “I don’t know how to use a router”. What followed was two days of intensive instruction and practice using different bits to make rounded edges, groves, etc. Then he left for the sailboat. Months later he returned, “What did you make?”, he asked. Again, I replied “Nothing”. “What not?” he asked. “Because I didn’t know what I wanted to do with it.”
I wanted the class to understand that: having ACL; and receiving instruction on how to use ACL does not guarantee that you will actually use ACL. Despite my many example of where and how it could be used – they needed to be able to see for themselves where they could use it for their audits. Otherwise, ACL would go back on the shelf and they would revert back to their old audit practices.
This has been a constant struggle for me – trying to help auditors understand not just the power of ACL (usually this is quite easy), but getting them to see where they can apply it to their daily work. They can run any command I ask, even determine which command is required to answer a question, but to look at an audit objective and determine the analysis that would support the audit in addressing the objective eludes them. If I give them analysis – they can do it; but they need to be led.
This does not only apply to auditors, but team leaders and audit managers – many (not all) can’t make the leap from theoretical to practice. And this is not just a problem I have – many expert ACL users I have talked to express the same frustration. “Why can’t more people see the analytics that are applicable to a given problem?” whether that is to test controls, verify compliance or identify and assess risk.
Recently, I was talking to my daughter about animation and graphic design. She was trying to explain something to me, and while the words all made sense, I could figure out what she meant. Eventually it dawned on me that she could “see” things from a different perspective, and, even though we were using the same language, I couldn’t understand what she was talking about. To her, it was simple and she couldn’t understand why I was so stupid (my words, not hers).
I realized that this may apply to analytics. When I envision a business process, I picture the data that supports that process. I can see how the input data is captured, transformed and processed; and what the output should look like. I can the control points and risks if controls are not applied. Others see the people involved in the processing of the information; and others see the business procedures and rules. Like the old adage about three blind men and the elephant. We don’t see what the others see.
Trying to get auditors to ‘see’ the data requires getting them to use a different lens. This does not mean ignoring the people and the processes, but supplementing that understanding with the technology (data). So, now I think I understand what the issue is – but I am still struggling with finding a way to get auditors to ‘see’ the data when they look at a process. It is so simple for me that I don’t know how to explain it. By looking at payment terms, payment methods, invoice number, invoice dates, approvals, vendor info, etc. I can see how the accounts payable process works. I can see where there are inefficiencies, risks and control weaknesses – before I even do a walkthrough. When I point them out to the auditors, most will understand and be able to follow up, but even these auditors don’t seem to be able to apply the same approach/concepts to a different business process.
So, I am curious. Am I missing something? Should I be doing more or something different to help them to be more self-sufficient in their analysis?
What is your experience – either as the expert on analytics or as the auditor – in trying to understand when, where, why and how to apply analytics?